Scanrules on ZAP

Configuring Scan Policies with Alert Tags

Wed, 03 Sep 2025 00:00:00 +0000

A new feature in ZAP’s automation framework allows you to configure scan policies using alert tags, making it easier to target specific types of vulnerabilities without manually managing individual scan rules.

The New 'ZAP is Out of Date' Rule

Fri, 25 Jul 2025 00:00:00 +0000

If you are using an old version of ZAP then you might start seeing a new alert…

Timing Related Scan Rule Changes

Tue, 22 Jul 2025 00:00:00 +0000

Scan rules related to time based attacks have been split or renamed.

ZAP Scripts are now Full Scan Rules!

Wed, 17 Jul 2024 00:00:00 +0000

ZAP scripts can now do everything that scan rules can.

Polyfill.io Script Detection

Thu, 27 Jun 2024 00:00:00 +0000

A new scan rule which allows you to find out which of your sites are loading scripts from polyfill.io really quickly.

Spring4Shell Detection with ZAP

Mon, 04 Apr 2022 00:00:00 +0000

How to detect Spring4Shell with the new Spring4Shell Alpha Active Scan Rule.

ZAP and Log4Shell

Fri, 10 Dec 2021 00:00:00 +0000

ZAP appears to be impacted by the Log4Shell vulnerability - CVE-2021-44228. We have released ZAP 2.11.1 which fixes the problem, this blog post gives more information and the impact on older versions of ZAP.

Hacking ZAP #4 - Active scan rules

Wed, 30 Apr 2014 00:00:00 +0000

Welcome to a series of blog posts aimed at helping you “hack the ZAP source code”.
The previous post in this series is: Hacking ZAP #3 - Passive scan rules

Active scan rules are another relatively simple way to enhance ZAP. Active scan rules attack the server, and therefore are only run when explicitly invoked by the user. You should only use active scan rules against applications that you have permission to attack.
You can also write active scan rules dynamically using scripts, as we will see later in this series, but even then it’s very useful to understand some of the concepts underlying classes available to you.

Hacking ZAP #3 - Passive scan rules

Thu, 03 Apr 2014 00:00:00 +0000

Welcome to a series of blog posts aimed at helping you “hack the ZAP source code”.
The previous post in this series is: Hacking ZAP #2 - Getting Started

One of the easiest ways to enhance ZAP is to write new passive scan rules.
Passive scan rules are used to warn the user of potential vulnerabilities that can be detected passively - they are not allowed to make any new requests or manipulate the requests or responses in any way.
They typically run against all of the requests and responses that flow through ZAP.
Passive rules run in separate background thread so that they have as little effect on performance as possible.